@bongos/core 1.21.103 → 1.21.105

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.103",
-  "core_contract": "1.21.103",
-  "source_commit": "56f5f9df610b5d9079d28702989bf24a9a462db9",
+  "core_version": "1.21.105",
+  "core_contract": "1.21.105",
+  "source_commit": "12969410e588a86536f6426de5dcd95390b3be6b",
   "source_ref": "HEAD",
-  "built_at": "2026-10-09T13:27:17.718Z",
+  "built_at": "2026-10-09T14:04:06.264Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 592,
     "agent_docs_stubbed": 28,
-    "functional_verbatim": 3020,
+    "functional_verbatim": 3021,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3641,
-  "tree_sha256": "3e52cfca3b8385e564d956ceaae717fbedb093d4db368a3c960d3f6db8c6139a",
+  "file_count": 3642,
+  "tree_sha256": "10dd1c422b8f42c90e7521862acb305b14d72053ddbe6c75511033ab149b694b",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2872,7 +2872,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "53e81515be4483fdb9a4d361335cbe9bac0efb82bd28946cf6b70d0ca28b0b3e"
+      "sha256": "9e09c3f6c9d01b93d3a0857d2115578a4e2268491278f11656efcf499c20b766"
     },
     {
       "path": "docs/modules-contract.md",
@@ -6832,7 +6832,7 @@
     {
       "path": "modules/lifecycle/check-rollup.js",
       "mode": "0000644",
-      "sha256": "3a69defc4e2157c104c9a95d2b67f4b68053c0a0e049683ddd9eb970d3f69871"
+      "sha256": "9109d29e5fc6739419c6584d4be2990516c2736c398ed8e3b916bb8b4627e0bb"
     },
     {
       "path": "modules/lifecycle/claim-eligibility.js",
@@ -6992,7 +6992,7 @@
     {
       "path": "modules/lifecycle/github-push.js",
       "mode": "0000644",
-      "sha256": "e52b3d90814272cacce172bccd24f437bac666dcb593b4604d435a5504c18ba7"
+      "sha256": "65386fff8736c1b55c1f105c595758161e718352077603d1ba9aa7dd05d6d1d6"
     },
     {
       "path": "modules/lifecycle/goal-advisory.js",
@@ -10137,12 +10137,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "bc23786ce9a171a96d049bc9568d8a73e513c0aa66783cedae0e51d4b16b6d93"
+      "sha256": "967618b349cf51650bbb10bb29c9304205ce8b84b0a61b0f26a84ff6b65751e8"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "923e849fd1ededbb5563d4c81dc9013c308a99a53f9d8595724fa8b35e831914"
+      "sha256": "6312c6a7441ab5c39cb567c6272d4a753edf0e2896a53b6cbb83e8c0713866d9"
     },
     {
       "path": "public-docs/index.html",
@@ -10162,7 +10162,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "5f152e713ca6f702119fe887e076a370e72ad380cd3c880ef56683202f3b573f"
+      "sha256": "7a99e0dae60fe796637cc0190ef51e49b0ff707b1a193bdab8b7f9444b953134"
     },
     {
       "path": "scripts/cron/style_guide_audit.sh",
@@ -11642,7 +11642,7 @@
     {
       "path": "scripts/gds/ship-flow.js",
       "mode": "0000644",
-      "sha256": "d114ae690d86270db76770fc3531a5530d1ab64a031a2528368864f4b330ac56"
+      "sha256": "ad768320095b1d6693e6da5cee1f8e857ac69cbbfbea0a64dfeaa7092c432de2"
     },
     {
       "path": "scripts/gds/ship-git.js",
@@ -11672,7 +11672,7 @@
     {
       "path": "scripts/gds/ship-land.js",
       "mode": "0000644",
-      "sha256": "e518039d82343b5ff3bb21e1a6e0a5a8e0b9368d05b791be4910d76ea075378e"
+      "sha256": "0b60f062ccf052a0eecb71fff3e0abf3c75cb2399786a286ab54df4091fff787"
     },
     {
       "path": "scripts/gds/ship-memory-sync.js",
@@ -11722,7 +11722,7 @@
     {
       "path": "scripts/gds/ship-visual.js",
       "mode": "0000644",
-      "sha256": "21ce15f1e49388bb3f8a46b9cfd8b05b23b77efbe93228ca04d9b13740e6d901"
+      "sha256": "a97c5628609b622ad8972e93af13ff32a85138c350756f4895bea24d469bc2fc"
     },
     {
       "path": "scripts/gds/ship.js",
@@ -12437,7 +12437,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "0228b28afc1fe4d1cd2a3e59ceeb9411a5ac0477bbdf95baf8a8de2100c2863a"
+      "sha256": "9f15b0adaa8dea1358b3c6d154c7ff2b378ce4bb7c8ba23c21f611861836aa11"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -14092,7 +14092,7 @@
     {
       "path": "tests/github_push_merge_driver.mjs",
       "mode": "0000644",
-      "sha256": "c4783b6e8171f96f4a83520cfc4335a313dbfce4702cccea6972e520d6f08deb"
+      "sha256": "5bf4d9ab391f0e457ec11b47197dd812487098d120f8fbba87dbddf7e23e92b9"
     },
     {
       "path": "tests/github_push_stderr_truncation.mjs",
@@ -17444,6 +17444,11 @@
       "mode": "0000644",
       "sha256": "75aa59accad12d197202457ed36281e5d3eca1040762a5045972c4b10cf09006"
     },
+    {
+      "path": "tests/ship_visual_regrade.mjs",
+      "mode": "0000644",
+      "sha256": "4e469f6f5801032dff196a57a84eeb3603e7a53760144a7ed4d582699c9747f9"
+    },
     {
       "path": "tests/ship_zero_commit.mjs",
       "mode": "0000644",

package/docs/module-api-changelog.md

@@ -3043,5 +3043,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.21.101 with no explicit bump. run 37935415352. (task 1002620)
   1.21.103 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.102 with no explicit bump. run 37936846665. (task 1002620)
+  1.21.104 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.103 with no explicit bump. run 37939497390. (task 1002620)
+  1.21.105 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.104 with no explicit bump. run 37941330141. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/lifecycle/check-rollup.js

@@ -39,4 +39,14 @@ function readCheckRollup(rollup) {
   };
 }
 
-module.exports = { readCheckRollup, UNIT_REPORT_CONTEXT };
+// The conclusions that mean a check really FAILED (task 1004666). One set for both
+// readers: the laptop's ship-land.js (task 1003764) and the server's mergeBlockReason.
+// readCheckRollup maps a status context's state into `conclusion`, so PENDING and
+// EXPECTED (posted but unfinished, or required but not yet reported) land there too —
+// those are waiting, not red. The server reader used to count anything outside
+// SUCCESS/NEUTRAL/SKIPPED as failing, which named a still-running check as the reason
+// a PR was red and sent the publish reconciler after a regen-heal it did not need.
+const RED_CONCLUSIONS = new Set(['FAILURE', 'ERROR', 'TIMED_OUT', 'CANCELLED', 'ACTION_REQUIRED', 'STARTUP_FAILURE']);
+const isRedCheck = (c) => !!c && RED_CONCLUSIONS.has(String(c.conclusion || '').toUpperCase());
+
+module.exports = { readCheckRollup, UNIT_REPORT_CONTEXT, RED_CONCLUSIONS, isRedCheck };

package/modules/lifecycle/github-push.js

@@ -40,7 +40,7 @@ const os = require('node:os');
 const path = require('node:path');
 const { promisify } = require('node:util');
 const { repoInfo, userAgent } = require('../../src/module-api');
-const { readCheckRollup, UNIT_REPORT_CONTEXT } = require('./check-rollup');
+const { readCheckRollup, UNIT_REPORT_CONTEXT, isRedCheck } = require('./check-rollup'); // isRedCheck: only a FAILED check is red, never a pending one (task 1004666)
 const { loadRepoInfo } = repoInfo;
 
 const execFileP = promisify(execFile);
@@ -951,10 +951,6 @@ async function getMergeState({ branch }, deps = {}) {
   };
 }
 
-// A non-passing check conclusion (everything that isn't a clean success/skip).
-const _BAD_CHECK = (c) =>
-  c.conclusion && !['SUCCESS', 'NEUTRAL', 'SKIPPED'].includes(String(c.conclusion).toUpperCase());
-
 // Human-readable reason a not-yet-merged PR isn't mergeable, surfaced to a
 // credential-less session so it reports the truth instead of guessing.
 function mergeBlockReason(s) {
@@ -967,7 +963,7 @@ function mergeBlockReason(s) {
   if (s.review_decision === 'CHANGES_REQUESTED') return 'changes_requested';
   if (s.review_decision === 'REVIEW_REQUIRED') return 'review_required';
   if (s.merge_state === 'BLOCKED') {
-    const bad = s.checks.filter(_BAD_CHECK);
+    const bad = s.checks.filter(isRedCheck);
     if (bad.length) return `failing_check:${bad[0].name}`;
     // Red, and the failing check is one of the nulled nodes: say the list is blind
     // rather than guess "review or pending", which sent a ship retrying (task 1003988).
@@ -975,7 +971,7 @@ function mergeBlockReason(s) {
     return 'blocked_required_review_or_pending_check';
   }
   if (s.merge_state === 'UNSTABLE') {
-    const bad = s.checks.filter(_BAD_CHECK);
+    const bad = s.checks.filter(isRedCheck);
     return bad.length ? `non_required_check_failing:${bad[0].name}` : 'non_required_check_pending';
   }
   if (s.mergeable === 'UNKNOWN' || s.merge_state === 'UNKNOWN' || s.merge_state == null) {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.103",
+  "version": "1.21.105",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.103",
+      "version": "1.21.105",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.103",
+  "version": "1.21.105",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9464,5 +9464,17 @@
       "id": "1004684",
       "text": "New house rule, Slop Bongo: when an AI realises it was wrong about something, it now says 'Bongo Slop Detected, Filing Bug' in chat and files a bug against the doc or message that misled it, so the same mistake stops repeating"
     }
+  ],
+  "1.21.104": [
+    {
+      "id": "1004665",
+      "text": "When a builder re-runs a review and attaches a screenshot, the screenshot now actually gets attached to the task. Before, it was quietly thrown away, so reviewers asking for a picture never saw one unless someone added it by h"
+    }
+  ],
+  "1.21.105": [
+    {
+      "id": "1004666",
+      "text": "A check that is still running is no longer reported as a failed one. Before, a project whose test service posts a \"still working\" status would see its change called broken and trigger a pointless repair attempt; now it is corr"
+    }
   ]
 }

package/scripts/gds/ship-flow.js

@@ -139,7 +139,7 @@ async function shipMain() {
     const action = evaluateResumeAction({ task, lastClaim, builder: me.data.builder });
     if (action.action === 'resume-grade') {
       console.log(`Task #${taskId} is at 'completed' (grade stalled) and ${action.via === 'owner' ? 'you last held the claim' : 'you are an Archon'} — resuming the grade (no re-claim needed).`);
-      return regradeMain();
+      return regradeMain({ visual });
     }
     if (action.action === 'resume-merge') {
       console.log(`Task #${taskId} is at 'confirmed' (merge/deploy stalled) and ${action.via === 'owner' ? 'you last held the claim' : 'you are an Archon'} — resuming the merge + deploy (no re-claim needed).`);
@@ -822,12 +822,12 @@ async function persistRegradeSummary({ taskId, summaryArg, task }) {
 //     promotes completed→confirmed + awards credits on pass, idempotent)
 //   - on pass: the normal confirmed→shipped merge + sync tail runs.
 
-async function regradeMain() {
+async function regradeMain(opts = {}) {
   await requireSession();
   const args = process.argv.slice(2);
   const taskId = Number(args[0]);
   if (!Number.isFinite(taskId)) {
-    console.error('usage: node scripts/gds/ship.js <task-id> --regrade [--summary-file <path|-> | --summary "..."] [--response-file <path|-> | --response "..."] [--no-merge] [--force] [--verified] [--base <ref>]');
+    console.error('usage: node scripts/gds/ship.js <task-id> --regrade [--summary-file <path|-> | --summary "..."] [--response-file <path|-> | --response "..."] [--visual <image>] [--visual-alt "caption"] [--no-merge] [--force] [--verified] [--base <ref>]');
     process.exit(2);
   }
   // task 1003702: refuse --notes rather than swallowing it. The reasoning — why
@@ -840,6 +840,16 @@ async function regradeMain() {
     for (const line of regradeNotesRefusal(taskId)) console.error(line);
     process.exit(2);
   }
+  // task 1004665: --visual used to be screened by shipMain and then dropped here
+  // without a word — this path returned before shipMain's upload, so visual_url
+  // stayed null (task 1004351). Screen it at the same early position as the
+  // --notes refusal (bad input costs no grade spend), and attach it on every
+  // path below that goes on to grade or land. shipMain's resume-grade dispatch
+  // hands over the visual it already screened rather than reading the file twice.
+  const visual = opts.visual !== undefined ? opts.visual : shipVisual.fromArgs(args, { regrade: true });
+  const attachVisual = async () => (visual
+    ? shipVisual.upload({ taskId, visual, client: await cliClient(), errorLine: apiErrorLine })
+    : false);
   const regradeProse = resolveProse(args, ['summary', 'response']);
   const summaryArg = regradeProse.summary;
   // task 1002662: the builder's response to the prior round's findings — how
@@ -908,6 +918,7 @@ async function regradeMain() {
   // only re-publishes the branch (the recovery for a publish that failed).
   if (tweakHold.isHeldForArtist(task, tRes.data.grade ? tRes.data.grade.passed : null)) {
     console.log(`Task #${taskId} already passed its grade and is waiting for the artist: re-publishing its branch, not re-grading.`);
+    await attachVisual();
     await finishShip({
       taskId, summary: summaryArg || task.value_summary || '', held: true, postGradeStatus: 'completed', doneLine: 'Done.',
       card: { title: task.title, valueSummary: summaryArg || task.value_summary || '', notes: '' },
@@ -989,6 +1000,7 @@ async function regradeMain() {
       console.log('');
       console.log(`Nothing to grade (the committed diff vs ${graderBaseline || 'baseline'} is empty) and this ship`);
       console.log('declares itself artifact-free — manual-confirming via POST /tasks/:id/confirm.');
+      await attachVisual();
       // A kind='verify' task cannot reach here without --verified: the gate above
       // exits first, so the server's verify_attestation_required can't fire below.
       const confirm = await (await cliClient()).tasks.postTasksIdConfirm({ id: taskId, body: { verified } });
@@ -1060,6 +1072,9 @@ async function regradeMain() {
   // the panel runs afterwards. The row, the grader prompt, the merge commit and
   // the PR then all carry the same sentence.
   await persistRegradeSummary({ taskId, summaryArg, task });
+  // task 1004665: the picture goes up at the same point and for the same reason
+  // as the summary — after every guard that can still refuse, before the panel.
+  await attachVisual();
 
   // ---- Delta-aware prior-round context (task 1002662) ----
   // The prior grade's findings + the builder's response + the interim fix diff

package/scripts/gds/ship-land.js

@@ -18,7 +18,7 @@ const { normalizeApiError } = require('./ship-io.js');
 const { plainCardLines } = require('./plain-cards.js');
 // The server's own reader of a PR's check rollup (task 1003988), reused so the laptop
 // poll names a red PR exactly the way publish-status does (task 1003764). Dependency-free.
-const { readCheckRollup, UNIT_REPORT_CONTEXT } = require('../../modules/lifecycle/check-rollup.js');
+const { readCheckRollup, UNIT_REPORT_CONTEXT, RED_CONCLUSIONS } = require('../../modules/lifecycle/check-rollup.js');
 const { prMergeSentence } = require('../../modules/lifecycle/page-tweak-hold.js');
 
 // ---------- the land outcome (task 1002541, part 1) ----------
@@ -474,7 +474,7 @@ function redBlocksMerge(md) {
 // A check conclusion (CheckRun) or state (status context) that means FAILED. Pending and
 // expected are waiting, not red — reporting them as failures would be the mirror image of
 // the bug this names (a failure dressed as waiting).
-const RED_CONCLUSIONS = new Set(['FAILURE', 'ERROR', 'TIMED_OUT', 'CANCELLED', 'ACTION_REQUIRED', 'STARTUP_FAILURE']);
+// The set itself lives in check-rollup.js, shared with the server's mergeBlockReason (task 1004666).
 
 // localMergeDriver — task 1003764. The laptop path watches its PR with the builder's own
 // gh, and read only state + mergeCommit, so a red required check was invisible for the

package/scripts/gds/ship-visual.js

@@ -28,17 +28,24 @@ const taskVisuals = require('../../modules/lifecycle/task-visuals');
 // EXITS (code 2) on bad input: this runs before any heavy work, so a wrong path
 // costs the builder a retyped command, not a claim. Pure enough to reason about;
 // the exit is the deliberate CLI edge.
-function fromArgs(args) {
+//
+// `regrade: true` is the `ship.js <id> --regrade` caller (task 1004665). There is
+// no claim left to resolve on that path, so the wording names what IS true there:
+// the task stays at completed, and the picture goes up before the grade runs.
+function fromArgs(args, { regrade = false } = {}) {
   const file = arg('--visual', args) || '';
   if (!file) return null;
   const read = taskVisuals.readImageFile(file);
   if (!read.ok) {
-    console.error(`Ship aborted: --visual ${file} — ${read.message}`);
-    console.error('Fix the path (or drop --visual: a visual is always optional). No claim resolved, no credits awarded.');
+    console.error(`${regrade ? 'Re-grade' : 'Ship'} aborted: --visual ${file} — ${read.message}`);
+    console.error(regrade
+      ? 'Fix the path (or drop --visual: a visual is always optional). Nothing was graded; the task stays at completed.'
+      : 'Fix the path (or drop --visual: a visual is always optional). No claim resolved, no credits awarded.');
     process.exit(2);
   }
   const visual = { ...read, alt: arg('--visual-alt', args) || '', name: path.basename(file) };
-  console.log(`--visual: ${visual.name} (${visual.contentType}, ${Math.round(visual.buf.length / 1024)} KB) — uploaded after the claim resolves.`);
+  const when = regrade ? 'uploaded before the re-grade runs' : 'uploaded after the claim resolves';
+  console.log(`--visual: ${visual.name} (${visual.contentType}, ${Math.round(visual.buf.length / 1024)} KB) — ${when}.`);
   return visual;
 }
 

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.103'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.105'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/github_push_merge_driver.mjs

@@ -12,6 +12,7 @@
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
+import fs from 'node:fs';
 
 const require = createRequire(import.meta.url);
 const gh = require('../modules/lifecycle/github-push.js');
@@ -169,6 +170,51 @@ test('mergeBlockReason maps the common blocker states', () => {
   assert.equal(gh.mergeBlockReason({ ...open, merged: true }), null);
 });
 
+// --- task 1004666: a check still running is waiting, not red --------------
+//
+// check-rollup maps a status context's state into `conclusion`, so PENDING and
+// EXPECTED (posted but unfinished, or required but not yet reported) reached
+// mergeBlockReason as conclusions. It counted anything outside SUCCESS/NEUTRAL/
+// SKIPPED as failing, so a BLOCKED PR waiting on a third-party status read
+// "failing_check:<context>" and the reconciler tried a regen-heal on it.
+
+const ctx = (context, state) => ({ __typename: 'StatusContext', context, state, description: null });
+
+test('1004666 a PENDING or EXPECTED status context on a BLOCKED PR reads as waiting', async () => {
+  for (const state of ['PENDING', 'EXPECTED']) {
+    const { fetchImpl } = mkFetch({ node: prNode({ mergeStateStatus: 'BLOCKED', rollup: 'PENDING', checks: [TRUST, ctx('ci/external', state)] }) });
+    const r = await gh.mergeIfGreen({ branch: 'claude/wt' }, DEPS(fetchImpl));
+    assert.equal(r.reason, 'blocked_required_review_or_pending_check', `${state} is not a failure`);
+  }
+});
+
+test('1004666 on an UNSTABLE PR a pending optional check is pending, not failing', () => {
+  const open = { pr_state: 'open', merged: false };
+  assert.equal(gh.mergeBlockReason({ ...open, merge_state: 'UNSTABLE', checks: [{ name: 'e2e', conclusion: 'PENDING' }] }), 'non_required_check_pending');
+  assert.equal(gh.mergeBlockReason({ ...open, merge_state: 'UNSTABLE', checks: [{ name: 'e2e', conclusion: 'TIMED_OUT' }] }), 'non_required_check_failing:e2e');
+});
+
+test('1004666 every red conclusion still names its check, past a pending one', () => {
+  for (const state of ['FAILURE', 'ERROR', 'TIMED_OUT', 'CANCELLED', 'ACTION_REQUIRED', 'STARTUP_FAILURE']) {
+    const open = { pr_state: 'open', merged: false, merge_state: 'BLOCKED' };
+    assert.equal(gh.mergeBlockReason({ ...open, checks: [{ name: 'ci/external', conclusion: 'PENDING' }, { name: 'unit', conclusion: state }] }), 'failing_check:unit', state);
+  }
+});
+
+test('1004666 the server and the laptop read red from ONE set', () => {
+  const rollup = require('../modules/lifecycle/check-rollup.js');
+  const land = fs.readFileSync(new URL('../scripts/gds/ship-land.js', import.meta.url), 'utf8');
+  const push = fs.readFileSync(new URL('../modules/lifecycle/github-push.js', import.meta.url), 'utf8');
+  assert.ok(land.includes("RED_CONCLUSIONS } = require('../../modules/lifecycle/check-rollup.js')"), 'ship-land imports the shared set');
+  assert.doesNotMatch(land, /const RED_CONCLUSIONS\s*=/, 'and no longer declares its own');
+  assert.doesNotMatch(push, /_BAD_CHECK|'SUCCESS', 'NEUTRAL', 'SKIPPED'/, 'the old allow-list reading is gone');
+  for (const c of ['PENDING', 'EXPECTED', 'SUCCESS', 'NEUTRAL', 'SKIPPED', 'STALE', null, undefined]) {
+    assert.equal(rollup.isRedCheck({ conclusion: c }), false, String(c));
+  }
+  assert.equal(rollup.isRedCheck({ conclusion: 'failure' }), true, 'case-insensitive like the old reader');
+  assert.equal(rollup.isRedCheck(null), false);
+});
+
 // --- task 1003988: a red PR names what failed, or says it cannot see -------
 //
 // Without Checks:read GitHub nulls every CheckRun node and keeps the rollup state,

package/tests/ship_visual_regrade.mjs

@@ -0,0 +1,167 @@
+// tests/ship_visual_regrade.mjs — `ship.js <id> --regrade --visual <image>`
+// attaches the picture (task 1004665).
+//
+// It used to be dropped without a word: shipMain screened --visual and then
+// returned into regradeMain() before its own upload, and regradeMain never
+// looked at the flag, so visual_url stayed null (hit on task 1004351, where a
+// grader blocker asked for screenshots). These cases pin the screening wording
+// on the re-grade path, the best-effort upload, and the wiring — every path
+// regradeMain takes to grade or land attaches the visual first.
+//
+// Run:  node tests/ship_visual_regrade.mjs
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import { mkdtempSync, writeFileSync, readFileSync, rmSync } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+const require = createRequire(import.meta.url);
+const shipVisual = require('../scripts/gds/ship-visual.js');
+
+const PNG = Buffer.concat([Buffer.from('89504e470d0a1a0a0000000d49484452', 'hex'), Buffer.alloc(64)]);
+const TMP = mkdtempSync(path.join(os.tmpdir(), 'ship-visual-regrade-'));
+const good = path.join(TMP, 'after.png');
+writeFileSync(good, PNG);
+process.on('exit', () => rmSync(TMP, { recursive: true, force: true }));
+
+// Capture console output and turn process.exit into a throw, so the CLI edge of
+// fromArgs can be asserted without ending the test process.
+function capture(fn) {
+  const out = []; const err = []; const warn = [];
+  const saved = { log: console.log, error: console.error, warn: console.warn, exit: process.exit };
+  console.log = (...a) => out.push(a.join(' '));
+  console.error = (...a) => err.push(a.join(' '));
+  console.warn = (...a) => warn.push(a.join(' '));
+  process.exit = (code) => { const e = new Error(`exit ${code}`); e.exitCode = code; throw e; };
+  let result; let exitCode = null;
+  try {
+    result = fn();
+  } catch (e) {
+    if (e.exitCode === undefined) throw e;
+    exitCode = e.exitCode;
+  } finally {
+    Object.assign(console, { log: saved.log, error: saved.error, warn: saved.warn });
+    process.exit = saved.exit;
+  }
+  return { result, exitCode, out: out.join('\n'), err: err.join('\n'), warn: warn.join('\n') };
+}
+
+// ---- screening ------------------------------------------------------------
+
+test('no --visual means null on both paths, and nothing printed', () => {
+  for (const opts of [undefined, { regrade: true }]) {
+    const r = capture(() => shipVisual.fromArgs(['1', '--regrade'], opts));
+    assert.equal(r.result, null);
+    assert.equal(r.out + r.err, '');
+  }
+});
+
+test('on --regrade a good image is screened and says it goes up BEFORE the grade', () => {
+  const r = capture(() => shipVisual.fromArgs(['1', '--regrade', '--visual', good, '--visual-alt', 'the after'], { regrade: true }));
+  assert.equal(r.exitCode, null);
+  assert.equal(r.result.contentType, 'image/png');
+  assert.equal(r.result.alt, 'the after');
+  assert.match(r.out, /uploaded before the re-grade runs/);
+  assert.doesNotMatch(r.out, /claim resolves/, 'a re-grade has no claim left to resolve');
+});
+
+test('a normal ship keeps its own wording', () => {
+  const r = capture(() => shipVisual.fromArgs(['1', '--visual', good]));
+  assert.match(r.out, /uploaded after the claim resolves/);
+});
+
+test('on --regrade a bad path aborts BEFORE any grade, with re-grade wording', () => {
+  const r = capture(() => shipVisual.fromArgs(['1', '--regrade', '--visual', path.join(TMP, 'missing.png')], { regrade: true }));
+  assert.equal(r.exitCode, 2);
+  assert.match(r.err, /^Re-grade aborted: --visual/);
+  assert.match(r.err, /Nothing was graded; the task stays at completed/);
+  assert.doesNotMatch(r.err, /No claim resolved/);
+});
+
+// ---- upload ---------------------------------------------------------------
+
+function fakeClient(response) {
+  const calls = [];
+  return {
+    calls,
+    tasks: { postTasksIdVisual: async (req) => { calls.push(req); return response; } },
+  };
+}
+
+test('upload posts the image to the task and reports it stuck', async () => {
+  const client = fakeClient({ ok: true, status: 201, data: {} });
+  const visual = { buf: PNG, contentType: 'image/png', alt: 'cap', name: 'after.png' };
+  const r = await (async () => {
+    const saved = console.log; const out = [];
+    console.log = (...a) => out.push(a.join(' '));
+    try { return { ok: await shipVisual.upload({ taskId: 7, visual, client, errorLine: () => '' }), out }; } finally { console.log = saved; }
+  })();
+  assert.equal(r.ok, true);
+  assert.equal(client.calls.length, 1);
+  assert.equal(client.calls[0].id, 7);
+  assert.equal(client.calls[0].body.image_b64, PNG.toString('base64'));
+  assert.equal(client.calls[0].body.alt, 'cap');
+});
+
+test('a failed upload is a warning naming the manual re-attach, never a failure', async () => {
+  const client = fakeClient({ ok: false, status: 403, data: { error: 'nope' } });
+  const visual = { buf: PNG, contentType: 'image/png', alt: '', name: 'after.png' };
+  const saved = console.warn; const warn = [];
+  console.warn = (...a) => warn.push(a.join(' '));
+  let ok;
+  try { ok = await shipVisual.upload({ taskId: 7, visual, client, errorLine: (d, s) => `HTTP ${s}` }); } finally { console.warn = saved; }
+  assert.equal(ok, false);
+  assert.match(warn.join('\n'), /node scripts\/gds\/task\.js visual 7 <image>/);
+});
+
+test('no visual uploads nothing', async () => {
+  const client = fakeClient({ ok: true });
+  assert.equal(await shipVisual.upload({ taskId: 7, visual: null, client, errorLine: () => '' }), false);
+  assert.equal(client.calls.length, 0);
+});
+
+// ---- wiring ---------------------------------------------------------------
+
+const src = readFileSync(new URL('../scripts/gds/ship-flow.js', import.meta.url), 'utf8');
+const stripComments = (s) => s.replace(/^\s*\/\/[^\n]*$/gm, '');
+const regrade = stripComments(src.slice(src.indexOf('async function regradeMain'), src.indexOf('module.exports')));
+const ship = stripComments(src.slice(src.indexOf('async function shipMain'), src.indexOf('async function regradeMain')));
+
+test('regradeMain screens --visual early, before the preflight and the panel', () => {
+  const screen = regrade.indexOf('shipVisual.fromArgs(args, { regrade: true })');
+  assert.ok(screen !== -1, 'regradeMain screens the flag itself');
+  assert.ok(screen < regrade.indexOf('preflight(claimLike'), 'before the preflight');
+  assert.ok(screen < regrade.indexOf('gradeAndRecord('), 'before any grade spend');
+});
+
+test('every path regradeMain takes to grade or land attaches the visual first', () => {
+  // Three ways out that do real work: the held re-publish, the artifact-free
+  // confirm, and the graded path. Each finishShip must be preceded by an attach
+  // that sits AFTER the previous finishShip — i.e. one attach per path.
+  const finishes = [...regrade.matchAll(/await finishShip\(/g)].map((m) => m.index);
+  const attaches = [...regrade.matchAll(/await attachVisual\(\)/g)].map((m) => m.index);
+  assert.equal(finishes.length, 3, 'three landing paths (update this pin if one is added)');
+  assert.equal(attaches.length, 3, 'one attach per landing path');
+  let prev = -1;
+  finishes.forEach((f, i) => {
+    assert.ok(attaches[i] > prev && attaches[i] < f, `landing path ${i + 1} attaches before it lands`);
+    prev = f;
+  });
+  // The graded path attaches before the panel runs, after the summary persists.
+  const graded = attaches[2];
+  assert.ok(regrade.indexOf('await persistRegradeSummary(') < graded, 'after every guard that can refuse');
+  assert.ok(graded < regrade.indexOf('gradeAndRecord('), 'before the grade');
+  // The artifact-free path attaches before the confirm call lands it.
+  assert.ok(attaches[1] < regrade.indexOf('postTasksIdConfirm('), 'before the manual confirm');
+});
+
+test('a plain re-ship that resumes the grade hands over the visual it screened', () => {
+  assert.match(ship, /return regradeMain\(\{ visual \}\)/);
+  assert.match(regrade, /opts\.visual !== undefined \? opts\.visual : shipVisual\.fromArgs/);
+});
+
+test('the re-grade usage line advertises --visual', () => {
+  const usage = regrade.slice(0, regrade.indexOf('process.exit(2)'));
+  assert.match(usage, /--regrade [^\n]*--visual <image>/);
+});